Google froze its open source bug bounty program due to a ‘significant rise’ in AI submissions

According to extensive reporting from outlets including TechCrunch, Tom's Hardware, IT Pro, BleepingComputer, Infosecurity Magazine, and AOL.com, Google has officially frozen and paused its open-source bug bounty program. The suspension specifically targets new product vulnerability reports and product flaw submissions. Coverage from IT Pro and Tom's Hardware points directly to a significant rise in automated submissions, characterized as AI slop and hallucinations, with maintainers reportedly drowning in invalid reports. The halt on product flaw submissions is scheduled to last until 2027. Various media sources have emphasized different aspects of this disruption.

TechCrunch and BleepingComputer frame the incident around an AI spam surge impacting security programs. Meanwhile, outlets such as ROCK 95.5, FOX Sports Radio, and The Patriot KEIB AM 1150 report simply that Google has shut down the bug bounty program due to bots. IT Pro highlights a direct statement explaining that the pause is due to a significant rise in automated submissions where the vast majority are not valid. NeoTeo specifically refers to the action as a pause on the Open Source Software Vulnerability Reward Program for new product reports, while Infosecurity Magazine describes it as a suspension due to AI vulnerability reports. This trend highlights a growing crisis in technology safety, with AOL.com noting that artificial intelligence is actively breaking one of the most critical ways the industry keeps technology safe.

Bug bounty programs rely on human security researchers to find and report genuine flaws in software. The influx of automated submissions, bots, and AI hallucinations overwhelms the systems and human maintainers tasked with reviewing the submissions. Observers and participants will need to watch for further announcements from Google regarding the mechanics of the Open Source Software Vulnerability Reward Program as the 2027 resumption date approaches. Coverage does not yet detail how other technology companies are adjusting their own security bounty programs to handle similar potential waves of artificial intelligence spam. Current reports remain strictly focused on the immediate freeze enacted by Google and the operational strain caused by invalid automated submissions across its platforms.